topic Re: C9800 HTTP authorization with AAA in Wireless

C9800 HTTP authorization with AAA

Fairytale16 — Mon, 05 Jul 2021 18:34:52 GMT

Hi,

I wonder if the community can advice on the problem below.

I'm configuring a stack of C9800 16.12.1

And I want to configure HTTP authorization via AAA.

First it should ask Radius, then go Local.

The Radius is not available now, but the WLC refuses to log in under local account.

I'm connecting on SP IP.

The configuration:

aaa group server radius RADIUS_SRV
server name RADIUS_1
server name RADIUS_2

username cisco privilege 15 password cisco

aaa new-model

aaa authentication login Local_Access group RADIUS_SRV local

radius server RADIUS_1
address ipv4 172.22.1.1 auth-port 1812 acct-port 1813
timeout 5
key smth
!
radius server RADIUS_2
address ipv4 172.22.1.2 auth-port 1812 acct-port 1813
timeout 5
key smth

ip http authentication aaa login-authentication Local_Access

Thank you in advance.

Re: C9800 HTTP authorization with AAA

Jurgens L — Thu, 23 Jan 2020 04:27:58 GMT

Did you follow this document below for setting up the WLC?

https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/214490-configure-radius-and-tacacs-for-gui-and.html

<<< Pls remember to rate all useful responses >>>

Re: C9800 HTTP authorization with AAA

Fairytale16 — Thu, 23 Jan 2020 04:58:39 GMT

Thank you, Jurgens.

I've missed that doco.
It works now.

The working configuration below:
aaa group server radius RADIUS_SRV
server name RADIUS_1
server name RADIUS_2
!
username cisco privilege 15 password cisco
enable secret cisco
!
aaa new-model
!
aaa authentication login Local_Access group RADIUS_SRV local
aaa authorization exec Local_Access group RADIUS_SRV local if-authenticated
!
!
radius server RADIUS_1
address ipv4 172.22.1.1 auth-port 1812 acct-port 1813
timeout 5
key smth
!
radius server RADIUS_2
address ipv4 172.22.1.2 auth-port 1812 acct-port 1813
timeout 5
key smth
!
ip http authentication aaa login-authentication Local_Access
ip http authentication aaa exec-authorization Local_Access
!

Re: C9800 HTTP authorization with AAA

Scott Fella — Thu, 23 Jan 2020 04:58:48 GMT

If you change the auth to local then radius, can you login with local credentials?

Re: C9800 HTTP authorization with AAA

Jurgens L — Thu, 23 Jan 2020 05:17:30 GMT

Glad you came right, and thanks for sharing the working config!